Ubiquiti Inc.: Read-Only user can execute arbitraty shell commands on AirOS

On the last version of AirOS including the 8.0 beta is possible to a read-only user to inject shell commands. Is possible to exploit the vulnerability using the following URL adjusting the airosid value to a valid session:...

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow (PoC)

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow PoC + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SMBGRIND-BUFFER-OVERFLOW.txt Vendor: ======================= Network Associates Inc. Product: =========================================...

Ubiquiti Inc.: Auth bypass on directory.corp.ubnt.com

The researcher ebrietas demonstrated that access to our Internal corporate directory could be gained due to a misconfiguration in Google OpenID. This involved using a non-UBNT Google account and modification to the URL. The issue was resolved and the researcher was awarded a bounty for his...

Delta Industrial Automation DCISoft 1.12.09 - Local Stack Buffer Overflow

Delta Industrial Automation DCISoft 1.12.09 - Local Stack Buffer Overflow !/usr/bin/env python Delta Industrial Automation DCISoft 1.12.09 Stack Buffer Overflow Exploit Vendor: Delta Electronics, Inc. Product web page: http://www.delta.com.tw Software link:...

JVN#22578691: Akerun - Smart Lock Robot App for iOS fails to verify SSL server certificates

Akerun - Smart Lock Robot App for iOS provided by Photosynth Inc. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information...

Cisco Unified IP Phone Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Debian Security Advisory DSA 3470-1 (qemu-kvm - security update)

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service via resource exhaustion, that could occur when receiving large packet...

Ebay Inc (Pages) - CS Cross Site Scripting Vulnerabilities

Document Title: =============== Ebay Inc Pages - CS Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1626 Release Date: ============= 2016-02-07 Vulnerability Laboratory ID VL-ID: ====================================...

Ebay Inc (Pages) - CS Cross Site Scripting Vulnerabilities

Document Title: =============== Ebay Inc Pages - CS Cross Site Scripting Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1626 Release Date: ============= 2016-02-07 Vulnerability Laboratory ID VL-ID: ====================================...

Netgear RP614v3 Authentication Bypass

Vendor : NETGEAR Product : RP614v3 informed on : 12. 10. 2015 responded : no fixed : no Effect : Remotely exploitable over LAN/WLAN Typ : Authentication Bypass Difficulty : trivial The N300 FW authentication bypass inspired me to check my rp614v3 router and I found this bypass: Firmware:...

Fisher-Price Smart Toy platform allows some unauthenticated web API commands

Overview The Fisher-Price Smart Toy does not perform proper authentication of some API commands, and it may also use a vulnerable version of Android. Description The Fisher-Price Smart Toy bear is a new WiFi-connected Internet of Things IoT toy. The device utilizes network connectivity to provide...

Nexus Security Bulletin - February 2016Stay organized with collectionsSave and categorize content based on your preferences.

We have released a security update to Nexus devices through an over-the-air OTA update as part of our Android Security Bulletin Monthly Release process. The Nexus firmware images have also been released to the Google Developer site. Builds LMY49G or later and Android M with Security Patch Level o...

eBay Magento Persistent Mail Encoding

Document Title: =============== Ebay Magento Bug Bounty 2 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1203 eBay Inc. Bug Bounty Program ID: EIBBP-26644 Release Date: ============= 2016-01-18 Vulnerability Laboratory ID...

granitegraniteinc.com XSS vulnerability

Vulnerable URL: http://www.granitegraniteinc.com/SPSWebConnectNew.php?act=ajax=0=1=15=flawtech%22%3E%3Csvg/onload=prompt/XSSPOSED/%3E&=1453582876365 Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:53 GMT Vulnerability type:| XSS Vulnerabilit...

JVN#09268287: Multiple Buffalo network devices vulnerable to cross-site request forgery

Multiple network devices provided by BUFFALO INC. contain a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be conducted. Solution Update the firmware Update the firmware according to the information provided by...

JVN#49225722: Multiple Buffalo network devices vulnerable to cross-site scripting

Multiple network devices provided by BUFFALO INC. contain a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the firmware Update the firmware according to the information provided by the developer. Products Affecte...

Juniper Junos IGMPv3 Protocol Multicast DoS (JSA10714)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to a flaw in the IGMPv3 implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted IGMPv3 packet, to affect service availability o...

Ebay Magento Bug Bounty #2 - Persistent Web Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 2 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1203 eBay Inc. Bug Bounty Program ID: EIBBP-26644 Release Date: ============= 2016-01-18 Vulnerability Laboratory ID...

sterlingservicesinc.com XSS vulnerability

Vulnerable URL: http://www.sterlingservicesinc.com/sterlingservices/FAQcategorylist.asp?groupName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Ubiquiti Inc.: Subdomain Takeover in http://assets.goubiquiti.com/

Hi there, Its urgent issue about your subdomain http://assets.goubiquiti.com pointing to AWS S3 but no such website configuration is made. This unused subdomain can claim by anyone and fully take over it. An attacker can fully takeover this subdomain and do whatever he wants. this can cause huge...